Your AI that actually shows up.
Tell her what needs doing on your PC. Ava plans it, shows you the steps, then works your real apps — clicking, typing, switching windows — and stops to ask before anything irreversible. Every other automation product clicks; she decides when to.
This is what we’re building. The foundations (persona orchestration, safety ontology, kill switches, real Playwright and OmniParser integrations) are already in. UI wiring and end-to-end trajectories come next.
Windows first. macOS next. Will be available on every tier, including Free, once it ships.
The difference
Everyone else has a clicker. We’re building the brain that decides when to click.
Five specialists, one step
Scout observes. Planner decides. Actor executes. Verifier checks. Narrator tells you what just happened. Focused mindsets beat one model trying to do everything.
Memory across sessions
Ava will remember how to navigate your apps. Every other agent relearns them every time. Run a workflow twice and you’ll feel the difference.
A plan you approve first
Before she touches anything, Ava shows you the steps she means to take. Nothing runs until you say go, and you can stop it at any point.
Your machine, your credentials
Runs on your actual computer. Uses your existing logins. No cloud browser renting out sessions. Never uploads your screen content for training.
Safety by construction
Designed after reading every public autonomy incident. Every layer here exists because another product failed at it.
Irreversible actions always confirm — and approval never caches
Send, submit, pay, delete, publish. Each one will ask fresh every time. The industry caches these. That’s the exact hole attackers exploit.
Session whitelist, not persistent
At mode entry: “You may work in Gmail, VS Code, Azure.” Any app outside the list pauses and asks. Doesn’t remember between sessions. No “allow always” button.
Three kill switches
Triple-Escape global hotkey. Stop button always visible. Budget trip if a step/token/time cap hits. Any of them aborts the trajectory.
Git checkpoints before destructive ops
Where rollback is possible, it happens automatically. Where it isn’t — emails sent, payments made — the confirmation prompt says so explicitly.
Secrets never hit the model
Passwords, API keys, 2FA codes handled via opaque handles. Ava sees "{secret}", not the value. Never in memory, trajectory log, or prompt context.
Cost you can predict
Target numbers from the spec — live counter during, hard caps default on. Final billing unit sets at launch once we pick an OmniParser host.
Where we are
Want to be there when it ships?
Install the IDE today — it’s already a full 61-tool coding agent. Desktop automation will unlock in the IDE for everyone, Free tier included, once we’re ready to release it.